Recurring Findings

Employment Development: Recurring Material Internal Control Deficiencies

Federal Program	Issue	First Year Reported
	Department's Assertion	Page Number
Unemployment Insurance	EDD had weak general controls over its information systems for 2010?11. Specifically, EDD's entity-wide information security policy was outdated, risk management program was insufficient, and there was no incident response plan prior to January 2012.	2010-11
	Partially Corrected. Since January 2012, EDD has released thirteen Information Security policies that reflect changes in the direction of the EDD Information Security program that more closely aligns our program with federal and State guidelines. EDD is in the process of fully implementing all policies released. The following policies are currently in executive clearance: Data Handling Policy, Security Incident Management Policy, and Security System Maintenance Policy. Policies mentioned above do not include current and still relevant Information Security Policies.	41